From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugs-return-414427-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Received: (qmail 16647 invoked by alias); 6 Feb 2013 23:25:09 -0000
Received: (qmail 15771 invoked by uid 48); 6 Feb 2013 23:24:07 -0000
From: "mikpe at it dot uu.se" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug middle-end/52306] ICE in cselib_record_set, at cselib.c:2158
Date: Wed, 06 Feb 2013 23:25:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: middle-end
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: mikpe at it dot uu.se
X-Bugzilla-Status: NEW
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Changed-Fields:
Message-ID: <bug-52306-4-2wCkNwHS2n@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-52306-4@http.gcc.gnu.org/bugzilla/>
References: <bug-52306-4@http.gcc.gnu.org/bugzilla/>
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
Content-Type: text/plain; charset="UTF-8"
MIME-Version: 1.0
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
X-SW-Source: 2013-02/txt/msg00592.txt.bz2


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52306

--- Comment #17 from Mikael Pettersson <mikpe at it dot uu.se> 2013-02-06 23:23:58 UTC ---
Created attachment 29376
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=29376
reduced test case

Please disregard my last two comments, I misread the insn dump and mistook a
note for the invalid concurrent modification of a register.

Thorsten's initial xslt test case, attachment 27325, ICEs 4.6 and 4.7 -with -O2
-fPIC, and 4.8 with just -O2.  This new test case is substantially reduced from
the initial one, but it only ICEs 4.8.  The ICE occurs when cselib processes
insn 67.

IRA produced

(insn 67 66 69 10 (set (reg/f:SI 52 [ D.1521 ])
        (mem/f:SI (post_inc:SI (reg:SI 59 [ ivtmp.11 ])) [3 MEM[base: 0B,
index: ivtmp.11_66, offset: 0B]+0 S4 A16])) pr52306-4.c:44 38 {*movsi_m68k2}
     (expr_list:REG_INC (reg:SI 59 [ ivtmp.11 ])
        (nil)))

with, if I read the dump correctly, reg 52 mapped to %a1 and reg 59 spilled.

Reload then sees fit to reload reg 59 into %a1, resulting in

(insn 67 253 69 10 (set (reg:SI 9 %a1)
        (mem/f:SI (post_inc:SI (reg:SI 9 %a1)) [3 MEM[base: 0B, index:
ivtmp.11_66, offset: 0B]+0 S4 A16])) pr52306-4.c:44 38 {*movsi_m68k2}
     (expr_list:REG_INC (reg:SI 9 %a1)
        (nil)))

which uses %a1 both as an auto-inc source pointer and as the dest of the load,
causing the assertion failure in cselib.

The post_inc of reg 59 (%a1) is actually dead, reload added insns to load %a1
from reg 59's spill slot and to increment that memory cell directly.  I'm
guessing either reload should not have coalesced reg 59 with reg 52 (due to the
post_inc on reg 59), or it should have cancelled the post_inc when it added the
new insn to increment the spill slot directly.